@jsonjoy.com/fs-node-builtins

Repo bus factorcaution

One contributor made about 90% of the recent commits, and the repository owner is an individual rather than an organization, leaving a meaningful continuity risk despite two additional contributors.

Repo package mentioncaution

The linked repository name does not match the package name and its README does not mention this package, so the package-to-repository relationship is not clearly demonstrated even though it may be a monorepo subpackage.

Repo toolingcaution

The project uses TypeScript and npm build tooling, but no security-scanning tools were detected. The missing scanning is a modest transparency gap rather than evidence of abandonment.

Workflow auditcaution

All three workflows were analyzed with no untrusted checkout or script-injection paths, but all five action references are unpinned, one workflow grants top-level write access, and a high-confidence low-severity finding installs a package outside a lockfile.